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ABSTRACT 


This  paper  poses  a  framework  for  considering  human  supervisory 
control  of  semi-automatic  systems.  It  analyzes  supervisory  con¬ 
trol  into  specific  human  functions  and  gives  examples  of  research 
that  has  been  done  and/or  is  needed  with  respect  to  each  of  these 
functions.  For  each  such  function  it  is  argued  that  the  human 
supervisory  operator  necessarily  has  a  corresponding  mental 
model,  and  potentially  can  have  a  computer-based  decision  aid. 
The  relation  of  the  proposed  framework  to  the  canonical  modern 
control  paradigm  is  also  discussed,  as  are  the  reasonable  limita¬ 
tions  of  our  ability  to  model  such  complex  human-machine 
interaction  which  itself  exercises  a  high  degree  of  free  choice. 
Three  accompanying  papers  offer  detailed  contributions  to  three 
of  the  supervisory  functions  (and  corresponding  decision  aids) 
which  heretofore  have  been  neglected,  namely:  (1)  formation  of 
objectives  by  satisficing;  (2)  acquisition,  calibration  and  combina¬ 
tion  of  measures  of  process  state;  and  (3)  estimation  of  process 
state  from  current  measure  and  past  control  actions. 
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INTRODUCTION 


The  term  "supervisory  control”  stems  from  the  analogy  between  a 
supervisor  of  subordinate  staff  in  an  organization  of  people  and  the 
human  overseer  of  a  modern  computer-mediated  semi-automatic  control 
system.  A  supervisor  gives  human  subordinates  general  instructions 
which  they  in  turn  translate  into  action.  The  supervisor  of  a 
computer-controlled  system  may  do  likewise. 

Strictly  supervisory  control  means  one  or  more  human  operators  are 
setting  initial  conditions  for,  intermittently  adjusting,  and  receiving 
information  from  a  computer  that  itself  closes  a  control  loop  through 
artificial  sensors  and  effectors.  Sometimes  the  term  "supervisory 
control"  is  used  when  a  computer  transforms  human  operator  commands  to 
generate  detailed  control  actions,  or  makes  significant  transformations 
of  measured  data  to  produce  integrated  summary  displays.  In  the  latter, 
less  strict  definition  the  computer  need  not  have  the  capability  to 
commit  actions  based  upon  new  information  from  the  environment,  whereas 
in  the  first  it  necessarily  must.  The  two  situations  may  appear  similar 
to  the  human  supervisor,  since  the  computer  mediates  both  his  outputs 
and  his  inputs  and  the  supervisor  is  thus  removed  from  detailed  events 
ot  the  low  level. 

Figure  I  diagrams  a  supervisory  control  system.  The  human  operator 
gives  commands  c  to  a  "human-interactive"  computer  capable  of 
understanding  high  level  language  and  providing  Integrated  summary 
displays  of  process  state  Information  y  back  to  the  operator.  This 
computer,  typically  located  in  a  control  room  or  cockpit,  in  turn 
communicates  with  at  least  one,  probably  many  (hence  the  dotted  lines), 
"task-interactive  computers".  The  latter  computers  thus  receive  subgoal 
and  conditional  branching  information  from  the  human-interactive 
computer;  using  such  Information  as  "reference  Inputs"  they  serve  to 
close  the  low-level  control  loops  between  artificial  sensors  and 
mechanical  actuators,  i.e.,  accomplish  the  low  level  automatic  control. 
Since  the  low  level  task  typically  operates  at  some  physical  distance 
from  the  human  operator  and  his  human-friendly  display-control  computer 
(located  out  in  a  plant,  at  a  remote  location  on  an  aircraft  or  ship, 
out  in  space  or  undersea)  the  communication  channels  between  computers 
may  be  constrained  by  multiplexing,  time  delay  or  limited  bandwidth. 

The  task-interactive  computer,  of  course,  sends  to  and  receives  from  the 
controlled  process,  and  the  latter  does  the  same  with  the  environment  as 
it  operates  (vehicles  moving  relative  to  air,  sea  or  earth,  robots 
manipulating  objects,  process  plants  modifying  products). 

The  channels  of  supervisory  command  and  feedback  of  process  state 
information  are  shown  in  Figure  1  to  pass  through  the  left  side  of  the 
human  interactive  computer.  On  the  right  side  we  represent  the 
decision-aid  functions,  with  displayed  output  y'  being  advice  relevant 
to  requests  or  auxiliary  information  c'  which  the  operator  provides. 
Customarily  the  latter  interaction  has  not  been  recognized  explicitly  as 
part  of  a  supervisory  control  system  sepatate  from  the  command  and  state 
feedback  part.  New  developments  in  computer-based  "expert  systems"  and 
other  decision-aids  for  planning,  editing,  monitoring  and  failure 
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detection  have  changed  that.  Further,  reflection  upon  the  nervous 
systems  of  higher  animals  reveals  a  kind  of  supervisory  control  wherein 
commands  are  sent  from  the  brain  to  local  ganglia,  and  peripheral  motor 
control  loops  are  then  closed  locally  through  receptors  in  the  muscles, 
tendons  or  skin.  The  brain,  presumably,  does  higher  level  planning 
based  its  own  stored  data  and  "mental  models",  an  internalized  expert 
system  available  to  provide  advice  and  permit  trial  response  before 
commitment  to  actual  response. 

Initial  theorizing  about  supervisory  control  began  as  aircraft  and 
spacecraft  became  partially  automated  and  it  became  evident  that  the 
human  operator  was  being  replaced  by  the  computer  for  direct  control 
responsibility,  and  was  moving  to  a  new  role  of  monitor  and 
goal-constraint  setter  (Sheridan,  1960).  An  added  incentive  was  the  US 
space  program  which  posed  the  problem  of  how  a  human  operator  on  earth 
could  control  a  manipulator  arm  or  vehicle  on  the  moon  through  a  three 
second  communication  round-trip  time  delay.  The  only  solution  which 
avoided  instability  was  to  make  the  operator  a  supervisory  controller 
communicating  intermittently  with  a  computer  on  the  moon,  which  in  turn 
closed  the  control  loop  there  (Ferrell  and  Sheridan,  1967).  It  soon 
became  evident  that  the  rapid  development  of  microcomputers  was  forcing 
a  transition  from  manual  control  to  supervisory  control  in  a  variety  of 
industrial  and  military  applications;  the  design  of  display  and  control 
interfaces  was  seen  to  require  a  number  of  new  developments  (Sheridan 
and  Johannsen,  1976;  Sheridan,  1984).  The  National  Research  Council 
(1983,  1984)  recently  recognized  supervisory  control  as  one  of  the  most 
important  areas  in  which  new  human  factors  research  is  needed;  they 
review  a  variety  of  relevant  applications  and  problems. 


FUNCTIONS  OF  THE  HUMAN  SUPERVISOR;  CORRESPONDING  MENTAL  MODELS  AND 
DECISION  AIDS 

Table  1  lists  the  categories  of  human  supervisor  functioning  in  the 
order  in  which  they  normally  would  occur  in  performing  a  supervisory 
control  task.  Figure  2  presents  the  same  sequence  of  functions  in 
pictorial  flow-chart  form,  where  for  each  function  the  corresponding 
mental  model  is  shown  as  a  "thought  balloon”  of  what  the  supervisor 
might  be  asking  himself,  and  the  potential  computerized  decision  aid  is 
shown  as  a  rectangular  box.  The  functions  are  cross-referenced  by 
numbers  and  letters  over  each  corresponding  block  in  Figure  2.  Normally 
for  any  given  task  the  first  three  functions  are  performed  only  once  and 
off-line  relative  to  the  automatic  operation  of  the  system,  while  the 
remaining  functions  are  done  iteratively,  and  therefore  are  shown  within 
two  nested  loops,  as  will  be  explained  below. 

la.  The  first  broad  category  of  supervisory  functions  is  PLAN.  The 
first  specific  supervisor  function  under  PLAN  is  understand  controlled 
process ,  which  means  to  gain  some  understanding  of  how  the  given 
physical  thing,  equipment  or  system  which  is  to  be  operated  operates, 
how  it  works,  what  are  the  relations  by  which  inputs  to  it  become 
outputs.  This  is  usually  the  first  consideration  in  training  an 
operator.  The  idea  is  to  build  into  the  operator  a  mental  model  of  the 
controlled  process  which  is  appropriate  to  his  role  -  enough  knowledge 
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Table  1.  Functions  of  the  Human  Supervisor 
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of  che  appropriate  variables  and  Cheir  input-output  transfer  relations 
to  be  able  to  control  and  predict  what  the  process  will  do,  but  not 
details  that  are  irrelevant  to  operation.  The  current  research  on 
mental  models  (de  Kleer,  1979;  Gentner  and  Stevens,  1983)  has  tended  to 
concentrate  on  this  function.  A  new  generation  of  computer-based 
training  aids  has  been  developed  recently  which  includes  computer 
representation  in  terms  of  production  rules,  semantic  nets,  frames  or 
other  AI  mani fester  ions  which  has  encouraged  this  emphasis  (Holland  et 
al,  1984;  Harmon  and  King,  1985). 

lb.  The  second  specific  function  under  PLAN  is  satisfice  objectives. 

To  control  engineers  this  corresponds  to  obtaining  an  objective 
function,  a  closed-form  analytical  expression  of  "goodness"  which  is  a 
scalar  function  of  all  relevant  variables  or  "performance  attributes"  or 
"objectives".  To  a  mathematical  decision  theorist  it  may  correspond  to 
a  multiattribute  utility  function,  which  specifies  the  global  and 
unchanging  relative  goodness  or  badness  of  any  point  in  the  hyperspace 
of  all  relevant  attributes  (Keeney  and  Raiffa,  1976).  However  the 
behavioral  decision  scientist  knows  that  neither  of  the  above  models  of 
human  preference  works  very  well  in  practice,  that  people  find  it 
extremely  difficult  to  consider  levels  of  attributes  that  they  have 
never  experienced,  and  hence  they  cannot  provide  reliable  data  from 
which  to  generate  global  objective  or  utility  functions.  What  appears 
much  closer  to  the  way  people  actually  behave  is  what  has  been  termed 
"satisficing"  (March  and  Simon,  1958;  Weirzbickl,  1982),  wherein  a 
tentative  aspiration  point  in  attribute  space  is  set  and  the 
decision-maker  considers  whether  he  can  achieve  this.  But  upon 
discovering  that  constraints  will  not  permit  this,  or  that  he  can 
achieve  something  more  that  what  he  aspired  to,  he  will  set  a  new 
aspiration  level  and  consider  whether  he  can  achieve  that,  eventually 
deciding  on  the  basis  of  time  and  energy  spent  in  thinking  about  it  that 
he  is  satisfied  with  some  one  set  of  objectives,  some  single  point  or 
small  indifference  region  in  attribute  space. 

The  computer  may  provide  aid  by  determining  for  any  aspiration  point 
whether  it  can  be  achieved,  or  whether  or  in  what  direction  he  can  do 
better,  all  the  while  reminding  him  what  set  of  options  are  pareto 
optimal,  i.e.,  not  dominated  by  a  point  in  attribute  space  which  is  not 
worse  in  any  attribute  and  is  better  in  one  or  more.  Charny  and 
Sheridan  (1986),  in  one  of  the  three  papers  accompanying  this  one, 
describe  the  development  of  an  interactive  computer-graphic  aid  to  help 
a  supervisor  "satisfice".  The  tool  allows  the  user  to  set  range 
constraints  on  the  attributes,  set  weights,  or  set  partial  solutions. 

The  aid  then  displays  the  implications  in  terms  of  what  is  feasible  and 
what  is  not,  what  are  "optimal"  solutions,  how  the  selected  "optimum" 
relates  to  other  decision  possibilities  in  multiattribute  space,  and 
perhaps  most  interesting,  how  much  the  weights  or  constraints  must 
change  in  order  for  a  different  "optimum"  to  emerge  -  in  other  words  a 
running  sensitivity  analysis.  Using  such  a  tool  the  supervisor  may  be 
expected  to  be  influenced  at  least  to  some  degree  by  goals  given  "from 
above"  by  employer,  professional  training,  laws  of  the  government,  early 
upbringing,  or  social/cultural  mores.  Nevertheless,  as  systems  become 
more  automated  in  their  actual  control,  the  free-will  imposition  or 
"tuning"  of  task  goals  (objective  function  set  by  a  satisficing  process) 


is  the  one  function  that  would  seem  impossible  to  automate 


lc.  The  third  specific  function  under  PLAN  is  set  general  strategy. 

The  supervisory  operator  is  usually  given  some  procedures  or  operating 
guidelines  which  he  is  to  follow  generally  (or  to  deviate  from  as 
required  for  the  particular  task  at  hand).  This  is  the  third  function 
which  is  usually  performed  off-line ,  before  the  automatic  system  starts 
up.  It  is  the  second  activity  usually  addressed  formally  in  training 
programs  (objective  function  setting  is  typically  not  addressed 
formally,  though  it  might  well  be).  The  mental  model  here  is  that  of 
the  general  operating  procedures  and  guidelines  which  must  be  committed 
to  memory  (where  detailed  procedures  can  be  accessed  and  read  as 
needed).  The  corresponding  computer  aid  here  is  one  for  procedures 
training.  To  help  the  supervisor  relate  the  strategy  planning  to  the 
satisficed  objectives  there  might  also  be  an  aid  for  optimization  in  a 
broad  sense,  particularly  when  the  general  procedures  are  not  already 
formulated  and  where  certain  goals  are  given  and  are  not  to  be  modified. 
Any  of  a  number  of  common  operations  research  techniques  might  be 
applied  here,  depending  upon  the  class  of  tasks. 

ld.  The  fourth  specific  function  under  PLAN  is  decide  and  test  control 
actions.  To  decide  control  actions,  of  course,  is  by  definition  the 
essential  function  of  any  controller  and  the  supervisory  controller  is 
no  exception.  On  the  first  pass  of  stepping  through  the  supervisory 
functions  this  function  would  consist  of  the  actions  necessary  to  start 
up  the  automatic  system,  but  on  successive  passes  the  specific  control 
decisions  must  necessarily  be  based  on  feedback  of  state.  The 
supervisor's  job  is  then  to  decide  what  procedures  are  appropriate  for 
the  estimated  state  and  what  specific  actions  are  implied,  in 
consideration  of  process  dynamics  and  satisficed  objectives  as  mentally 
modelled  in  steps  la,  lb  and  lc.  One  form  of  decision  aid  for  this 
function,  already  employed  in  some  modern  nuclear  power  and  process 
control  plants,  is  a  computerized  system  which,  upon  it's  own  estimation 
of  process  state,  displays  to  the  operator  the  preplanned  procedures 
which  most  fit  that  plant  condition.  These  are  not  Implemented 
automatically,  though  in  some  cases  they  could  be,  for  it  is  deemed 
important  to  give  the  human  supervisor  some  room  for  interpretation  in 
light  of  his  knowledge  about  process  or  objectives  that  are  not  shared 
by  the  computer.  Kok  and  Van  Wijk  (1978)  modeled  this  decision  function 
in  a  simple  supervisory  control  context.  Baron  et  al  (1980)  developed  a 
decision  model  of  aircrew  supervisory  procedures  implementation  which 
they  term  PROCRU  and  which  is  built  on  their  earlier  optimal  control 
model. 

Because  supervisory  control  is  discontinuous  and  because  each  packet  of 
commands  constitutes  a  commitment  for  some  period  of  time  and  some 
sequence  of  process  responses,  it  is  appropriate  that  the  supervisor 
test  out  his  commands  on  some  form  of  off-line  simulator  before 
committing  them  to  be  executed  in  the  real  system.  Part  of  the  mental 
activity  for  this  function  is  the  exercise  of  an  Internal  model  to  yield 
expected  results  of  hypothetical  control  actions,  i.e.,  "what  would 
happen  if  -  -?"  (where  "happen"  means  both  physical  response  of  the 
controlled  process  and  resulting  goodness  of  performance  relative  to 
objectives).  The  internal  model  prediction  may  then  be  compared  to  the 


7 


results  from  the  computer  simulator  test.  Early  models  of  supervisory 
control  embodied  this  idea  (Sheridan,  1976).  Yoerger  (1982)  implemented 
such  a  test  capability  in  his  supervisory  manipulation  interface, 
whereby  the  operator  could  see  a  graphic  display  of  just  where  a 
manipulator  arm  would  move  relative  to  a  workpiece  on  the  basis  of  given 
commands.  The  idea  of  testing  out  commands  before  committing  them  to 
action  has  had  many  antecedants,  both  in  computer  control  and  in 
behavioral  models.  For  example  Rasmussen  (1976)  Included  a  dynamic 
world  model  in  an  early  version  of  his  multilevel  model  of  behavior. 

2.  The  next  supervisory  function  is  TEACH,  which  means  to  decide,  test 
and  communicate  commands  necessary  to  give  the  computer  in  order  that  it 
be  able  to  Implement  the  intended  actions.  It  is  essential  at  this 
point  to  make  a  clear  distinction  between  commands  and  control  actions, 
since  in  normal  control  engineering  practice  and  indeed  normal 
activities  of  living  they  may  be  taken  to  be  the  same.  Commands  are  the 
operator's  movements  of  analogic  control  interface  devices  such  as 
joysticks,  master  manipulator  arms,  or  computer  screen  cursor  controls, 
and  his  stroking  of  symbolic  alphanumeric  and  special  function  keys, 
while  control  actions  are  the  responses  the  human-interactive  computer 
makes  to  these  commands  to  signal  the  task-interactive  computer, 
activate  motors  or  other  actuators,  and  thereby  force  the  controlled 
process  to  modify  its  state.  The  mental  model  in  this  case  is  the 
command  language  (the  set  of  admissible  symbols  or  words  or  movements, 
the  syntax  or  rules  for  their  combination,  and  the  semantics  or  meanings 
of  both  individual  symbols  and  combinations).  The  computer  aid  in  this 
case  is  an  editing  aid,  an  interactive  means  to  help  the  user  say  to  the 
computer  what  it  needs  to  hear  in  order  to  do  what  the  operator  wants 
done.  This  is  not  unlike  an  editing  aid  for  word  processing  or  for 
programming  in  general,  where  the  computer  informs  the  user  what 
commands  are  not  Interpretable,  and  might  come  back  and  suggest  what 
might  be  meant,  etc. 

There  have  been  many  developments  of  supervisory  command  languages.  In 
modern  aircraft  there  are  several  levels  of  commands  for  setting  the 
autopilot  (e.g.,  going  to  and  holding  a  new  altitude,  flying  to  a  set  of 
latitude-longitude  coordinates  on  the  other  side  of  the  earth,  making  an 
automatic  landing  (Yoerger,  1979).  In  industrial  robotics  various 
r.otocols  have  been  developed  for  using  "teach”  pendants  to  program 
simple  ln8truct-move-playback  routines.  More  sophisticated  symbolic 
command  structures  have  enabled  the  teaching  of  arbitrarily  defined 
terms,  conditional  branching,  etc.  (Nof,  1985).  Flexible  combined 
analogic-symbolic  connand  languages  such  as  SUPERMAN  (Brooks,  1979; 
Yoerger  1982)  have  been  developed  to  allow  very  fast  and  natural 
instruction  of  telerobots.  Supervisory  languages  currently  under 
development  promise  the  user  the  capability  to  use  fuzzy  (imprecisely 
defined)  commands  (Yared,  1986). 

3a.  The  next  category  of  supervisor  functions  is  MONITOR  AUTO,  meaning 
the  human  operator  monitors  the  automatic  execution  of  the  progammed 
actions.  This  includes  three  separate  functions,  the  first  of  which  is 
acquire,  calibrate  and  combine  measures  of  process  state.  This  requires 
that  the  supervisor  have  a  mental  model  of  potential  sources  of  relevant 
information,  their  likelihood  of  knowing  about  particular  variables  of 
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interest,  and  their  likely  biases  in  measuring  and  report. ng.  The  point 
is  that  there  can  be  many  sources  which  have  something  to  cell  about  any 
one  variable:  real-time  sensors,  computerized  data  bases  and  "expert 
systems",  human  experts,  and  incidental  sources  which  are  likely  to  be 
unreliable  but  may  provide  some  useful  evidence.  Some  sources  advertise 
themselves  as  being  very  precise  but  may  not  be,  others  may  be  much  more 
precise  than  first  expected.  Some  may  be  consistently  biased,  so  that 
if  only  the  bias  could  be  removed  they  would  provide  very  accurate 
measurements.  If  a  computerized  aid  could  help  sort  out  which  sources 
were  in  fact  precise  and  which  were  not,  could  remove  biases  and  could 
combine  data  sources  to  provide  corroboration  and  a  better  statistical 
sample,  that  could  be  a  real  boon  to  the  human  supervisor.  Mendel  and 
Sheridan  (1986)  have  done  just  that,  and  their  description  of  this  work 
is  described  fully  in  a  second  accompanying  paper. 

3b.  The  next  function  to  follow  is  estimate  process  state  from  current 
measure  and  past  control  actions.  Estimation  theory  provides  a 
normative  way  to  do  this,  which  is  commonly  used  in  modern  control 
practice.  This  requires  a  good  model  of  the  physical  process,  which  is 
not  ordinarily  available  in  complex  systems  controlled  by  a  human 
supervisor.  Presumably  the  human  supervisor  has  some  internal  (mental) 
model  of  how  past  control  actions  should  be  affecting  present  process 
response,  and  tries  to  combine  this  with  his  best  (but  likely  to  be 
inaccurate)  direct  measurement  data  on  current  process  state  in  order  to 
form  a  best  overall  estimate  of  current  state.  But  this  is  not  easy  for 
a  person,  especially  if  the  system  is  complex.  However  for  a  computer, 
given  a  good  model  of  the  controlled  process  and  a  single  best 
measurement  of  its  state  (which  still  is  likely  to  be  imperfect),  it  is 
relatively  straightforward  to  calculate  the  best  estimate  of  current 
state.  The  problem  then  comes  in  displaying  this  to  a  human  operator  in 
a  way  which  is  meaningful  and  useful. 

Roseborough  and  Sheridan  (1986),  in  the  third  companion  paper,  describe 
experiments  wherein  human  controllers  of  partly  deterministic,  partly 
stochastic  processes  (which  is  characteristic  of  real  supervisory 
control  systems)  are  provided  with  such  normative  decision  aids. 

Results  show  that  operators  cannot  accommodate  cognitively  all  of  the 
state  Information  which  a  full  formal  estimate  makes  available,  and 
suggest  how  operators  take  various  shortcuts  to  simplify  their  cognitive 
tasks  in  making  use  of  the  advice  given  them. 

It  might  be  noted  that  each  of  many  separate  measurements  of  process 
state  could  Involve  internal  models  (using  Kalman  estimation  or  other 
model-based  techniques).  These  multiple  estimates  might  subsequently  be 
combined  by  Bayesian  or  other  methods.  Thus  it  is  conceivable  that 
function  3b  precede  3a. 


3c.  The  third  supervisory  function  under  MONITOR  AUTO  is  evaluate 
process  state;  detect  and  diagnose  failure  or  halt.  This  means  that  the 
operator  maps  state  information  relative  to  the  satisficed  objectives 
(which  may  not  be  straightforward  if  the  estimated  state  is  outside  the 
region  of  attribute  space  in  which  satisficing  was  done).  He  must 
detect  and  diagnose  whether  the  process  has  "failed"  (strayed 
sufficiently  far  from  expected  objectives)  or  whether  it  has  halted 


(stopped  before  the  commanded  actions  were  all  executed  without  getting 
into  trouble)  and  to  some  extent  must  diagnose  where  and  how.  The 
mental  model  accordingly  incorporates,  in  addition  to  the  state  estimate 
available  from  3b,  the  likely  modes  and  causes  of  failure  or  halt.  The 
computer  aid  in  this  case  is  an  aid  to  the  operator  for  detecting  and 
diagnosing  the  location  and  cause  of  failure  or  halt.  Recently  there 
have  been  a  number  of  computer  aids  developed  for  this  purpose,  some  of 
which  are  based  on  statistical  estimation  theory  (Curry  and  Gai,  1976), 
some  of  which  are  based  on  discrepancies  between  measured  variables  and 
component  models  (Tsach  et  al,  1983),  and  some  of  which  are  based  upon 
production  rules  and  other  AI  techniques  (Scarl  et  al,  1985). 

4a.  The  next  supervisory  function  is  INTERVENE,  which  is  conditional 
upon  detection  of  a  failure  or  halt  condition.  If  failure:  execute 
planned  abort  means  that  when  the  state  has  deviated  sufficiently  far 
from  what  is  desirable  -  or  supervisor  judgment  and/or  the 
computer-based  failure  detection  suggests  that  it  will  -  the  supervisor 
promptly  executes  an  already  programmed  appropriate  abort  command.  His 
mental  model  is  of  a  relatively  small  number  of  preplanned  abort 
commands  and  their  criteria  for  use.  A  computer  decision  aid  in  this 
case  can  advise  him  of  which  to  use  and  how  to  use  it. 

4b.  If  there  is  no  failure  and  the  process  has  halted  when  it  was 
expected  to,  the  supervisor  must  bring  the  task  to  completion  (execute 
an  appropriate  completion  command).  That  is,  if  normal  end  of  task: 
complete.  His  mental  model  is  of  a  relatively  small  number  of 
preplanned  commands  to  finish  off  the  task,  a  kind  if  Inverse  to  the 
startup,  and  he  should  have  some  knowledge  of  their  criteria  for  use. 

As  in  4a  the  computer  decision  aid  can  advise  which  to  use  and  how  to 
use  it.  If  there  is  no  failure  and  the  halt  condition  does  not  call  for 
normal  completion  the  operator  is  not  likely  to  have  a  simple  preplanned 
open  loop  command  at  the  ready,  and  must  cycle  back  to  Id  for  a  more 
considered  execution  of  the  next  step  in  supervisory  command  and 
computer  controlled  execution.  But  before  he  does  there  is  one 
important  function  to  perform. 

5a.  Because  of  the  complexity  of  systems  which  lend  themselves  to 
supervisory  control  the  recording  of  what  was  considered,  what  was 
commanded,  and  what  happened  cannot  be  left  to  informal  chance.  It  is 
an  important  function  of  the  human  supervisor  not  only  that  he  update 
his  own  experiential  mental  models  but  that  he  also  ensure  that  some 
computer-based  records  are  kept  for  later  use.  When  there  is  neither 
failure  nor  completion  and  the  supervisor  is  ready  to  cycle  back  to  Id 
the  LEARN  function  only  means  record  immediate  events  so  that  there  be 
some  immediate  human  memory  of  significant  events  and  an  update  of 
computer  records.  In  this  case  it  is  helpful  if  the  computer  aid  also 
provide  some  "memory  jogging"  display  such  as  a  chart  of  recent  state 
trajectories,  or  a  listing  alarms  or  other  key  events  (as  is  commonly 
done  in  nuclear  power  plants). 

5b.  When  the  task  is  terminated  either  by  abortion  in  response  to 
failure  or  by  normal  completion  it  is  then  important  to  exercise  the 
LEARN  function  in  a  more  extensive  manner.  In  this  case  analyze 
cumulative  experience  means  that  the  supervisor  should  recall  and 
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contemplate  the  whole  task  experience,  however  many  command  cycles  there 
were,  so  as  to  improve  his  readiness  when  called  upon  for  the  next  task. 
The  computer  aid  in  this  case  should  provide  some  cumulative  record  and 
analysis  in  a  form  that  can  be  accessed  and  used  later  during  the  PLAN 
phase. 

Thus  it  is  claimed  that  a  sequence  of  three  initial  functions,  an 
iterative  loop  of  eight  additional  functions,  and  one  final  function 
characterize  what  a  human  supervisor  does  (or  should  do)  in  a  variety  of 
complex  supervisory  control  systems.  The  outer  loop  shorn  in  Table  1 
merely  suggests  what  happens  when  undertaking  a  new  task. 


SUPERVISORY  CONTROL  AND  THE  CONVENTIONAL  CONTROL  PARADIGM 

Figure  2  showed  a  diagram  of  a  supervisory  control  system  representing 
the  sequence  of  supervisory  functions  as  they  relate  to  the  key  system 
variables,  the  task-interactive  computer  and  the  controlled  process. 
Figure  3  takes  this  same  set  of  variables  and  interrelates  them  in  the 
format  of  the  canonical  modern  control  paradigm  -  modified  as  necessary 
to  Include  all  the  functions  and  additional  variables  that  have  been 
discussed  above.  As  with  Figure  2,  Figure  3  cross  references  the 
functions  of  Table  1  with  numbers  and  letters  at  the  upper  left  of  each 
block. 

At  the  top  of  Figure  3  the  three  "off-line'*  planning  functions  la,  lb, 
and  lc  are  shown  in  sequence  as  in  Table  1  and  Figure  2.  At  successive 
stages  the  process  mental  models  of  natural  process  response  A  and 
forced  process  response  B,  the  mapping  of  state  attributes  to  objectives 
V  and  the  general  operating  strategy  K  are  generated.  When  K  is  used 
on-line  and  in-the-supervisory-loop  (function  Id)  it  takes  as  Inputs  not 
only  the  state  estimate  x  fed  back  from  3b  but  also  the  evaluation  fed 
back  from  3c. 

^  A 

The  mental  model  parameters  A  and  B  which  are  essential  for  3b  are 
Intended  by  the  operator  to  correspond  to  the  actual  physical  process 
parameters  A  and  B.  The  parameter  C,  in  turn  essential  to  feed  3b, 
represents  the  combination  of  physical  sensors  attached  to  the  process 
and  the  human  and  computer  "expert"  resources  actively  accessed, 
calibrated  and  combined  by  the  human  supervisor  and/or  a  computer  aid. 
Hence  C  represents  the  whole  of  the  jja  computer  process,  much  more  than 
just  a  passive  measurement  matrix.  C  represents  the  3a  mental  process 
and  the  discrepancy  between  y  and  y  which  drives  G  is  the  degree  to 
which  expected  results  of  past  actions  u  (3b)  are  insufficient  to 
completely  predict  y  so  that  there  must  be  a  correction  through  G. 

E  represents  the  communication  or  TEACH  interface  (function  2),  the 
transformation  of  analogic  and  symbolic  commands  into  control  actions  by 
the  computer(s).  F  represents  the  INTERVENE  interface  (function  4),  the 
detection  and  diagnosis  of  a  failure  or  halt  condition  and  the  possibly 
resulting  abort  or  completion  commands  which  by-pass  the  ugual  A 
communications  interface  E.  At  the  lower  left  the  models  E  and  B  are 
necessarily  in  tandem. 
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Together  the  parameters  A,  B,  C,  G  and  K  constitute  the  fully 
internalized  mental  model  of  the  supervisory  controller  operating  in  the 
iterative  or  "ln-the-supervisory-loop”  mode  much  as  they  do  in  the 
Baron-Kleinman-Levison  optimal  control  model  of  the  human  controller. 

In  the  supervisory  control  case,  however  we  explicitly  add  the  parameter 
V  as  an  internalized  mental  model,  and  call  for  the  recognition  of  C,  E 
and  F  as  interface  parameters  which  make  a  critical  difference  in  how 
the  whole  system  functions.  A  and  B  of  course  are  the  same  parameters 
as  in  the  conventional  control  paradigm.  The  la,  lb  and  lc  blocks  are 
necessary  add-ons  to  achieve  the  required  meta-control  or  parameter 
generation. 

As  yet  no  analytic  functions  have  been  put  in  all  of  the  blocks,  even 
those  in  the  closed-loop  portion  of  Figure  3,  such  that  analysis, 
simulation  and  modeling  follow  easily  and  naturally  therefrom.  That  is 
a  further  step. 


FACTORS  WHICH  LIMIT  OUR  ABILITY  TO  MODEL  SUPERVISORY  CONTROL  SYSTEMS 

There  are  two  factors  which  limit  our  ability  to  model  supervisory 
control  systems,  apart  from  the  fact  that  they  tend  to  be  complex. 

The  first  factor  is  the  same  as  that  which  makes  any  cognition  difficult 
to  model.  As  compared  to  direct  manual  control,  the  essence  of 
supervisory  control  seems  to  involve  cognition,  or  mental  activity, 
particularly  involving  objectives  and  command/contol  decisions  made  at 
least  partly  by  the  free  will  of  the  supervisor.  The  problem  is  that 
such  mental  events,  especially  when  the  task  is  relatively 
unconstrained,  are  not  directly  observable;  they  must  be  inferred.  This 
is  the  basis  for  the  ancient  mind-body  dilemma,  as  well  as  the  basis  for 
the  more  recent  rejection  by  behavioral  scientists  of  mental  events  as 
legitimate  scientlc  concepts.  Such  "behaviorism",  of  course,  is  out  of 
fashion  now;  computer  science  begat  behavioral  science  and  by  indirect 
inference  made  computer  programs  admissible  representations  of  what 
people  think.  However  the  limits  on  direct  measurement  of  mental  events 
do  not  seem  to  want  to  go  away. 

The  second  factor  is  more  specialized  to  supervisory  control.  It  is  a 
result  of  mental  models  internal  to  the  human  operator  and  computer 
decision  aids  external  to  him  being  used  freely  together.  If  the 
operator  chooses  to  follow  the  aid's  advice  what  can  be  said  about  his 
exercising  of  his  own  mental  model?  If  he  claims  to  "know”  certain 
facts  or  have  a  "plan"  which  happens  to  correspond  to  the  knowledge  or 
plan  in  the  computer,  can  the  normative  decision  aid  be  considered  a 
convenient  yardstick  against  which  to  measure  inferred  mental  activity? 
Where  there  is  free  interaction  between  the  two  it  is  difficult  to 
determine  what  is  mental  and  what  is  computer,  i.e.,  mental  and  computer 
models  are  more  easily  treated  as  a  combined  entity  which  produces 
operator  decisions. 

In  spite  of  these  difficulties  we  must  continue  efforts  to  model 
and  predict  human  behavior  in  this  more  and  more  prevalent  form  of 
control  system. 


CONCLUSION 


Twelve  sequential  functions  of  the  human  supervisor  of  a  semi-automatic 
control  system  are  characterized  in  detail,  together  with  a  review  of 
relevant  research.  For  each  function  a  mental  model  is  assumed  and  a 
computer  decision  aid  is  suggested.  The  elements  of  this  functional 
model  of  supervisory  control  are  related  to  the  elements  of  the 
canonical  model  of  modern  automatic  control.  Two  factors  which 
ultimately  limit  our  ability  to  model  human  behavior  in  such  situations 
are  presented. 
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